How to connect Apple Health to Windsurf

What do you get?

Windsurf can read selected Apple Health data through your local Syncky agent and request permitted write-back with source and undo. This registration does not disable syncky_send or syncky_ack; review tool requests deliberately. Free during launch; plans are coming later. See launch access and pricing.

Client health-data envelopes are sealed end to end. Relay sees delivery metadata and plaintext hub notices, but no health values. The local agent keeps plaintext JSON in its inbox; your chosen model sees what the agent supplies. iOS decides background timing and Health reads need an unlocked iPhone. Data can be hours old and writes wait for sync; undelivered envelopes leave Relay on acknowledgment or expiry, at most 7 days.

What do you need before setup?

Use Windsurf locally on the machine holding the agent home, Syncky Health on your iPhone, npm and Node.js 22.15 or newer available to the client process. The first npm run may download the agent. Choose your data and model deliberately. Package availability and acceptance by your installed client remain prerequisites.

The vendor's Windsurf Cascade MCP configuration backs local stdio and the configuration below, checked on November 3, 2026. The previous Windsurf documentation URL now redirects; the linked Cascade source distinguishes the active configuration from editor discovery. Use Cascade locally on the machine holding your paired agent home.

Setup, receiver and MCP must use the same paired SYNCKY_AGENT_HOME and matching saved relay; agent setup explains relay selection for each app build.

How do you set up Windsurf?

1. Check the runtime and initialize only a fresh home:

   npx -y @syncky/agent selftest
   npx -y @syncky/agent init --name "My agent"
   

   Reuse an existing initialized home instead of initializing again.

2. Request a private QR and code:

   npx -y @syncky/agent pair
   

   Pair your iPhone: scan in Syncky Health and pick the code on the iPhone. Scanning alone does not confirm trust. Select read types, allowed write types and Health permissions deliberately. Keep pairing credentials, invites and home files out of chat and logs. Let an existing receiver collect the proof; otherwise wait for it after the code pick:

   npx -y @syncky/agent wait --timeout 600
   

3. For ongoing receipt, deliberately start:

   npx -y @syncky/agent receive
   

   Keep one receiver per home and reuse an existing receiver. For on-demand use, run npx -y @syncky/agent receive --once when you want updates. MCP reads the agent's inbox files and neither pairs nor starts a receiver. Services and schedules require a separate choice.

4. In Cascade's MCP menu choose Open MCP config file and edit the file it opens, preserving other servers:

   {"mcpServers":{"syncky":{"command":"npx","args":["-y","@syncky/agent","mcp"]}}}
   

   The current vendor defaults are macOS/Linux ~/.config/devin/mcp_config.json, or $XDG_CONFIG_HOME/devin/mcp_config.json when set; Windows %AppData%/devin/mcp_config.json. Use the file opened by your installation, including builds with an isolated configuration directory. The older ~/.codeium/windsurf/mcp_config.json is documented as a separate stable-editor discovery file; do not assume it is Cascade's active config.

   The stdio command runs locally. The default agent home is ~/.syncky-agent. For a custom home, add env.SYNCKY_AGENT_HOME in the server entry with the absolute path of the same initialized/paired home used by your receiver; this avoids relying on variable interpolation.

5. After saving the manual configuration, press the refresh button in the MCP panel. The vendor's + Add Server action belongs to the plugin/template flow. Review the configured command and available tools and run the scope-only prompt below. Enterprise policy may restrict MCP or allow only approved server configurations. This guide makes no per-tool disabling or approval-default claim: request only intended operations and keep Health writes off on the iPhone unless wanted.

   The canonical npm command is npx -y @syncky/agent mcp. A generic alternative for compatible clients is the matching release's checksum-verified syncky-health.mcpb; verify its .sha256 sidecar and SHA256SUMS from releases before importing. Node.js is still required. Checksums detect damage, not a compromised release; local packaging tests do not establish client acceptance. This guide uses JSON and makes no Windsurf MCPB import claim.

What can Windsurf read and write?

The MCP server offers five tools. syncky_status shows pairing, scope and relay progress from local state. syncky_inbox returns what the iPhone sent, as raw JSON kept 30 days on your computer. syncky_skill returns the signed instructions that describe every message format. syncky_send sends a message to the iPhone: a Health write, applied at the next sync when the owner has allowed writing for that type and iOS Health permits it, or a sync report or access request, which the owner approves on the phone. syncky_ack marks inbox entries as handled. Status, inbox and skill only read; send and ack change things. An empty result is not a measured zero. This registration does not disable syncky_send or syncky_ack.

The agent keeps what the iPhone sent as daily JSON files in its home (inbox/), prunes them after 30 days, and keeps the last 100 send receipts. There is no database and no built-in summaries: your AI agent reads the files it needs.

Every write to Apple Health, every sync report request and every request for more Health types is a message the agent sends to the iPhone. Writes apply only to the types the owner allowed for writing in the app; a sync report or more Health types need the owner's tap on the phone. The signed skill (syncky_skill) carries the exact formats and limits. A report arrives only after you Review and Confirm on the iPhone; you can decline instead.

Write only owner-requested entries or entries covered by explicit standing approval. A write is applied only when its type is in the app's write allowance, within the agent's write scope, and authorized by HealthKit (iOS write permission). Entries identify the requesting agent as their source. A queued or sent write is not an applied write: read the phone's result in the inbox after the next sync. To undo, use the iPhone's remove-written-entries control or have the agent send a delete command for its own entry. Follow the operator security rules.

How do you test the connection?

Ask Windsurf: Use syncky_status to check the paired iPhone and its read/write scope. Do not read sample values or write anything. Expect a confirmed iPhone and its last reported scope. This reads local state without contacting Relay; it does not establish fresh delivery or complete data.

How do you troubleshoot this setup?

• Server not discovered: reopen the active file from Cascade's MCP menu, verify JSON and refresh after adding it. The stable editor discovery file is a different source, not necessarily the file Cascade opens.
• Runtime or startup error: ensure Node.js and npm are available to the local process and use setup's selftest. Check the command and args rather than assuming the editor's terminal environment matches.
• Organization blocks MCP: the vendor documents enterprise enablement and server allowlists. Local JSON cannot override team policy.
• Wrong or empty inbox: match the paired home and saved relay across setup, receiver and MCP. Do not initialize over existing state or assume a remote session shares local storage.
• Phone unconfirmed or data old: pick the phone's code and receive its proof. Check the receiver, selected categories, unlocked iPhone and Health permissions, then use Sync now. iOS decides later background timing.

What are the frequently asked questions?

Which Windsurf configuration should I edit?

Use Open MCP config file in Cascade. The vendor's current active defaults and the older stable-editor discovery file are distinct. The file opened by your installed build is the one to review.

Does adding this server disable writes or guarantee approval prompts?

No. The registration does not disable writes and this guide claims no client approval default. Keep writing off on the iPhone unless you want it, select scope deliberately and request only intended entries.

Does refreshing MCP keep the data current?

No. Refresh makes the configured MCP tools available; a separate receiver on the same paired home collects phone deliveries.

Review Privacy and the public security policy before sharing data with a model.

Agent setup · MCP comparison · All guides.

How do I approve writes and requests for access or reports?

This registration is not a read-only setup. Keep tool approval enabled and never auto-allow syncky_send or syncky_ack; approve only intended writes, sync report requests and access requests. For read-only work, disable or deselect syncky_send and syncky_ack using the client's supported tool controls; the model then cannot write to Health, request a report or more access, or mark inbox entries as handled. The registration itself disables neither. A report request sends a report only after Review and Confirm on the phone. An access request is queued, then the owner confirms individual read/write choices on the phone; the reply arrives in the inbox and the next ordinary sync delivers effective scope. Request approval is separate from permission to write Health values. See access request guidance.